General

  • Target

    710.exe

  • Size

    543KB

  • Sample

    210213-zjlwmvhw32

  • MD5

    491f2ac9b077b7007a73778f59673121

  • SHA1

    67fd6b402dbf97ebc71b9b67e40b4088add0c097

  • SHA256

    99b020bce44d4001a3bb69db2debe8ea525d8ef61f00005793fd55fb2d6f485e

  • SHA512

    5e47b3a0c536bc8fecb899c01aa5fad4ce1e3bb762abbfefc55e5e317545b33731200fa02b6099530356a4e7161e76064345b8147be09b9c46e75bd0e457fbd5

Malware Config

Extracted

Family

raccoon

Botnet

027bc1bb9168079d5f7473eee9c05ee06589c305

Attributes
  • url4cnc

    https://telete.in/jjbadb0y

rc4.plain
rc4.plain

Targets

    • Target

      710.exe

    • Size

      543KB

    • MD5

      491f2ac9b077b7007a73778f59673121

    • SHA1

      67fd6b402dbf97ebc71b9b67e40b4088add0c097

    • SHA256

      99b020bce44d4001a3bb69db2debe8ea525d8ef61f00005793fd55fb2d6f485e

    • SHA512

      5e47b3a0c536bc8fecb899c01aa5fad4ce1e3bb762abbfefc55e5e317545b33731200fa02b6099530356a4e7161e76064345b8147be09b9c46e75bd0e457fbd5

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks